1. Information about the collection and processing of your personal data
We hereby inform you about the processing activities regarding your personal data and your rights under data protection law.
2. Responsible body and data protection officer
The controller responsible for the processing activities is:
MEAG MUNICH ERGO Asset Management GmbH Am Münchner Tor 1, 80805 Munich
Telephone: (089) 2489-0
Email address: info@meag.com
You can contact our data protection officers at the above address or at datenschutz@meag.com. The contact details are also available via www.meag.com.
3. Categories of data used & origin of the data
We collect and process the following categories of personal data:
- Tenant master data from the main tenant and, if relevant, co-tenant (e.g. spouse) and/or authorized representatives of guarantors.
- More specifically: first name, surname, name affixes, contact details (e.g. private address, if different from the rental agreement), private and/or business (mobile) telephone number, e-mail address and other data, such as number of children (self-disclosure), date of birth, , bank details, salary data and Personal Public Service Number (PPSN).
- This may also include, if permitted by law, special categories of personal data (in accordance with Art. 9 GDPR).
Your personal data is usually collected directly from you during the rental process or during the tenancy. In certain circumstances, your personal data may also be collected from other sources due to legal requirements. In such case, we will inform you thereof separately.
In addition, we may have received data from third parties (e.g. brokerage websites, estate agents, credit rating agencies). If we process your data as part of a financial sanctions check, further data may be collected from public sanctions lists.
4. For what purposes and on what legal basis is my data processed?
| Purpose | Elements of Personal Data within each category | Purpose(s) of Processing. | Lawful Basis for Processing. |
| Data processing activities primarily serve the purpose of establishing, implementing and terminating the tenancy agreement. Data processing is carried out on the basis of Art. 6 (1) (b) GDPR (ie, processing is necessary for the performance of a contract with you). | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, postal address, email address. Financial Data: bank details, salary details, payslip Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS number, ID Passport or Driver License, Identity cards, Permit to live/ work in Ireland Other: occupation, references | To enable letting of vacant apartments, preparation of lease agreement and registration with RTB. Set up tenant on Yardi. | Performance of our contract with you |
| We also process your data in order to comply with our legal obligations as a landlord, such as complying with the prohibition on provision from the EU Anti-Terrorism Regulations 2580/2001 and 881/2002 and the avoidance of sanctions under the Foreign Trade and Payments Act in the event of violations of the prohibition on provision, and the relevant Irish equivalents. Data processing is carried out on the basis of Art. 6 (1) (c) GDPR (ie, processing is necessary for compliance with our legal obligation). | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, postal address, email address. Financial Data: bank details, salary details, payslip Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS number, ID Passport or Driver License, Identity cards, Permit to live/ work in Ireland Other: occupation, references | Compliance with landlord obligations under Irish law. Anti-money laundering / anti-terrorism screening. Compliance with EU sanctions regulations (e.g. Regulations 2580/2001 and 881/2002). Tax and reporting obligations. |
Compliance with a legal obligation |
| In addition, we may also request your consent to process your data for a specific purpose if the processing of your data is based on consent in accordance wiin accordance withth Art. 6 (1) (a) GDPR and Art. 7 GDPR. If you have given us your consent to process your data, you have the right to revoke this consent at any time with effect for the future without affecting the lawfulness of any processing based on consent before its withdrawal. If consent we seek your consentis obtained, we you will be inform youed separately about the purpose for which consent is sought and provide further details of the data processing activities in that regard. | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, postal address, email address. Financial Data: bank details, salary details, payslip Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS number, ID Passport or Driver License, Identity cards, Permit to live/ work in Ireland Other: occupation, references and further info to be addressed in the consent request. | Specific purposes clearly communicated at the time consent is requested. | Consent |
| In individual cases, we process your data in order to protect our legitimate interests or those of third parties (e.g. authorities). This applies in particular to internal data exchange for administrative purposes or the investigation of offences and the protection and enforcement of our contractual rights. Data processing is carried out on the basis of Art. 6 (1) (f) GDPR (ie, processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, unless your interests or fundamental rights and freedoms outweigh these interests). | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, postal address, email address. Financial Data: bank details, salary details, payslip Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS number, ID Passport or Driver License, Identity cards, Permit to live/ work in Ireland Other: occupation, references | Internal administrative purposes. Enforcement of contractual rights. Prevention and investigation of fraud or other offences. |
Legitimate interest |
| Furthermore, we reserve the right to use your data within the scope of our legitimate interest for the planning and execution of inventory sales and, if necessary, to pass it on to prospective buyers. Data processing is carried out on the basis of Art. 6 (1) (f) GDPR (ie, processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, unless your interests or fundamental rights and freedoms outweigh these interests). | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, postal address, email address. Financial Data: bank details, salary details, payslip Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS number, ID Passport or Driver License, Identity cards, Permit to live/ work in Ireland Other: occupation, references | Potential sales process in the future. | Legitimate interest |
5. To what extent do automated individual decision-making or profiling measures take place?
We do not use automated processing procedures to make decisions including.
6. How long will my data be stored?
We will delete your personal data as soon as it is no longer required for the above-mentioned purposes. If the tenancy agreement is not concluded, your personal data collected in the self-disclosure form will be stored for a further three months from the date of receipt of the self-disclosure by the responsible MEAG employee and then deleted in full.
After the tenancy agreement has ended, your personal data will be stored for as long as we are legally obliged to do so. In light of the general retention duty following from Irish (tax) law, this is 10 years. Storage periods may be extended in case of legal claims or other types of disputes. In those cases, we will store your personal data until the matter has been irrevocably closed.
7. Who receives my data?
Within our company, only those people and departments who need your personal data in light of their position will receive or otherwise process it.
Within our company, we sometimes use external service providers (processors) to fulfil our contractual and legal obligations. Only service providers who provide sufficient guarantees for an adequate level of data protection are used as processors.
Your personal data will be passed on to the following categories of recipients, as necessary:
|
Recipent |
Elements of Personal Data within each category | Purpose(s) of Processing. |
| The responsible property management company | Demographic data: Full name, date of birth, nationality Contact Details: postal address, email address, mobile and/or landline telephone number. Financial Data: bank details Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: passport, drivers’ license, PPS no. RTB no. Other: utility numbers | To set up tenants on MDPM sytems to enable MDPM take over management of the client site. |
| Tenant’s bank (SEPA payment provider) | Demographic data: Full name Contact Details: postal address Financial Data: Bank details Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: n/a Other: Deposit refundable | To refund a deposit to a tenant vacating a property. To refund an overpayment of Rent |
| Landlord confirmation Registration office / district administration office / housing offices / municipalities | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, postal address, email address. Financial Data: n/a Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS number, RTB registration number Other: | To register a tenancy with the RTB and to renew annually |
| Tax office | n/a | n/a |
| Insurance broker in the event of damage | Demographic data: Full name Contact Details: postal address, email address, mobile and/or landline telephone number. Financial Data: n/a Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: n/a Other: n/a | To process insurance claim |
| Craftsman in the event of damage and for repair and maintenance work | Demographic data: Full name Contact Details: postal address, email address, mobile and/or landline telephone number. Financial Data: n/a Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: n/a Other: n/a | To resolve maintenance issues for tenants |
| House bank for processing deposit payments | Demographic data: Full name Contact Details: postal address Financial Data: Bank details Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: n/a Other: Deposit refundable | To refund a deposit to a tenant vacating a property. Note we only provide information when a deposit is being refunded. The tenant provides the information when they initially pay their deposit to the landlord. |
| Deposit banks (processing of rental deposits) | Demographic data: Full name Contact Details: postal address Financial Data: Bank details Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: n/a Other: Deposit refundable | To receive a deposit from a tenant occupying a property. The tenant may provided the information when they initially pay their deposit to the landlord. |
| (Local) courts in cases involving, for example, debt collection / enforcement / claims (insurance) | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, email address, postal address. Financial Data: rent arrears data n/a Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS no. RTB registration number Other: | To collect rent and charge arrears from tenants on behalf of landlord. Move to dispute resolution, may involve legal. |
| Third-party debtors in the case of wage and salary garnishments and guarantees from authorised representatives | n/a | n/a |
| Estate agents, if relevant for re-letting | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, postal address, email address. Financial Data: bank details, salary details, payslip Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS number, ID Passport or Driver License, Identity cards, Permit to live/ work in Ireland Other: occupation, references | To enable letting of vacant apartments, preparation of lease agreement and registration with RTB. Set up tenant on Yardi. |
| Contract architects, if structural measures are necessary | n/a | n/a |
| External law firms in justified cases | Demographic data: Full name Contact Details: Home landline phone number, mobile phone number, email address, postal address. Financial Data: rent arrears data n/a Digital Identifiers: n/a Social Media: n/a Special Data: n/a Criminal Offences/convictions: n/a Government Identifiers: PPS no. RTB registration number Other: | To collect rent and charge arrears from tenants on behalf of landlord. Move to dispute resolution, may involve legal. |
| Insolvency administrators in the event of personal insolvency | n/a | n/a |
| Credit agencies | n/a | n/a |
| Owner’s association parking garage, in case of letting a parking space. | n/a | n/a |
| Prospective buyers in the event of portfolio sales | n/a | Tenancy schedule provided showing units occupied with a tenant ID number. Tenant name and contact information removed. |
| Tax advisors and auditors | n/a | n/a |
| Other tenants (e.g. extended access to documents) | n/a |
n/a |
8. Will my data be transferred to a third country?
To the extent that we transfer personal data to service providers outside the European Economic Area (EEA), the transfer will only take place if the third country has been confirmed by the EU Commission as having an adequate level of data protection or if other appropriate data protection guarantees (e.g. binding internal company data protection regulations or EU standard contractual clauses) are in place.
All data currently collected and processed by us in the Netherlands and Germany will not be transferred to a third country.
9. What data protection rights can I assert as a data subject?
The governing privacy and data protection laws, including the GDPR, give you rights over your personal data. These entail the following:
- Right to withdraw consent: in so far as our processing of your personal data is based on your consent you have the right to withdraw consent at any time without affecting the lawfulness of any processing based on consent before its withdrawal.
- Right of access: you have the right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you (but not necessarily the documents themselves). We will then also provide you with further specifics regarding our processing of your personal data.
- Right to rectification: you have the right to request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
- Right to erasure: you have the right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where: (i) the personal data are no longer necessary, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the personal data have been unlawfully processed, (v) the personal data have to be erased on the basis of a legal requirement, or (vi) where the personal data have been collected in relation to the offer of information society services. We do not always have to honour your request; in case any of the exceptions apply, we may refuse to delete your personal data.
- Right to object: you have the right to object to processing of your personal data where we are relying on legitimate interests as processing ground (see above).
- Right to restriction: you have the right to request restriction of processing of your personal data in case: (i) the accuracy of the personal data is contested by you, during the period we verify your request, (ii) the processing is unlawful and restriction is requested by you instead of erasure, (iii) we no longer need the personal data but they are required by you for the establishment, exercise or defence of legal claims, or (iv) in case you have objected to processing, during the period we verify your request. If we have restricted the processing of your personal data, this means that we will only store them and no longer process them in any other way, unless one of the exceptions applies.
- Right to data portability: you have the right to request to transfer of your personal data to you or to a third party of your choice (right to data portability). If this right applies to you, we will provide you, or such third, your personal data in a structured, commonly used, machine-readable format.
We will do our best to respond to your request within one month. We will contact you if we need more information from you in order to fulfil your request or verify your identity. Occasionally, a request might take longer than a month to fulfil, depending on the number and complexity of requests we receive. In such case, we will inform you. We will always inform you within one month of receiving your initial request.
Please note that we will not always be able to accommodate your request(s). For example, erasure of data will not be possible if storing such data is mandatory for us to keep complying with applicable laws and regulations. In such cases, we will inform you about this.
You do not have to pay to access your personal data or to exercise your other rights. However, in some cases, we may charge a reasonable fee depending on the amount of work needed to deal with your request. If that is the case, we will inform you thereof before handling your request(s).
Should you have concerns about your privacy rights or should you feel unsatisfied with the treatment of your request, we remind you that you have the right to lodge a complaint with a supervisory authority under the governing privacy and data protection laws, including the GDPR, in the Member State of your residence, place of work or place of an alleged infringement of data protection law.
The data protection supervisory authority in Germany is Bavarian State Office for Data Protection Supervision, who can be contacted at:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Tel: +49 (0) 981 180 093-0
Email: poststelle@lda.bayern.de.
Website: https://www.lda.bayern.de.